Redis高级实用特性：安全性与主从复制

安全性

设置客户端连接后进行任何其他指定前需要使用的密码。

警告：因为redis速度相当快，所以在一台比较好的服务器下，一个外部的用户可以在一秒钟进行150K次的密码尝试，这意味着你需要指定非常非常强大的密码来防止暴力破解。

# requirepass foobared

requirepass beijing

下面我们做一个实验，说明redis的安全性是如何实现的。

我们设置了连接的口令是beijing

那么们启动一个客户端试一下:

[root@localhost redis-2.2.12]# src/redis-cli

redis 127.0.0.1:6379> keys *

(error) ERR operation not permitted

redis 127.0.0.1:6379>

说明权限太小，我们可以当前的这个窗口中设置口令

redis 127.0.0.1:6379> auth beijing

OK

redis 127.0.0.1:6379> keys *

1) "name"

redis 127.0.0.1:6379>

我们还可以在连接到服务器期间就指定一个口令，如下:

[root@localhost redis-2.2.12]# src/redis-cli -a beijing

redis 127.0.0.1:6379> keys *

1) "name"

　redis 127.0.0.1:6379>

可以看到我们在连接的时候就可以指定一个口令。

主从复制

Redis主从复制配置和使用都非常简单。通过主从复制可以允许多个slave server拥有和master server相同的数据库副本。

1、redis主从复制特点:

(1)、master可以拥有多个slave

(2)、多个slave可以连接同一个master外，还可以连接到其他slave

(3)、主从复制不会阻塞master，在同步数据时，master可以继续处理client请求

(4)、提高系统的伸缩性

2、redis主从复制过程:

当配置好slave后，slave与master建立连接，然后发送sync命令。无论是第一次连接还是重新连接，master都会启动一个后台进程，将数据库快照保存到文件中，同时master主进程会开始收集新的写命令并缓存。后台进程完成写文件后，master就发送文件给slave，slave将文件保存到硬盘上，再加载到内存中，接着master就会把缓存的命令转发给slave，后续master将收到的写命令发送给slave。如果master同时收到多个slave发来的同步连接命令，master只会启动一个进程来写数据库镜像，然后发送给所有的slave。

3、如何配置

配置slave服务器很简单，只需要在slave的配置文件中加入如下配置

slaveof 192.168.1.1 6379 #指定master的ip和端口

下面我们做一个实验来演示如何搭建一个主从环境:

# slaveof <masterip> <masterport>

slaveof localhost 6379

我们在一台机器上启动主库(端口6379)，从库(端口6378)

启动后主库控制台日志如下:

[root@localhost redis-2.2.12]# src/redis-server redis.conf

[7064] 09 Aug 20:13:12 * Server started, Redis version 2.2.12

[7064] 09 Aug 20:13:12 # WARNING overcommit_memory is set to 0! Background save may fail under low memory condition. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect.

[7064] 09 Aug 20:13:12 * The server is now ready to accept connections on port 6379

[7064] 09 Aug 20:13:13 - 0 clients connected (0 slaves), 539512 bytes in use

[7064] 09 Aug 20:13:18 - 0 clients connected (0 slaves), 539512 bytes in use

[7064] 09 Aug 20:13:20 - Accepted 127.0.0.1:37789

[7064] 09 Aug 20:13:20 * Slave ask for synchronization

[7064] 09 Aug 20:13:20 * Starting BGSAVE for SYNC

[7064] 09 Aug 20:13:20 * Background saving started by pid 7067

[7067] 09 Aug 20:13:20 * DB saved on disk

[7064] 09 Aug 20:13:20 * Background saving terminated with success

[7064] 09 Aug 20:13:20 * Synchronization with slave succeeded

[7064] 09 Aug 20:13:23 - 0 clients connected (1 slaves), 547380 bytes in use

启动后从库控制台日志如下:

[root@localhost redis-2.2.12]# src/redis-server redis.slave

[7066] 09 Aug 20:13:20 * Server started, Redis version 2.2.12

[7066] 09 Aug 20:13:20 # WARNING overcommit_memory is set to 0! Background save may fail under low memory condition. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect.

[7066] 09 Aug 20:13:20 * The server is now ready to accept connections on port 6378

[7066] 09 Aug 20:13:20 - 0 clients connected (0 slaves), 539548 bytes in use

[7066] 09 Aug 20:13:20 * Connecting to MASTER...

[7066] 09 Aug 20:13:20 * MASTER <-> SLAVE sync started: SYNC sent

[7066] 09 Aug 20:13:20 * MASTER <-> SLAVE sync: receiving 10 bytes from master

[7066] 09 Aug 20:13:20 * MASTER <-> SLAVE sync: Loading DB in memory

[7066] 09 Aug 20:13:20 * MASTER <-> SLAVE sync: Finished with success

[7068] 09 Aug 20:13:20 * SYNC append only file rewrite performed

[7066] 09 Aug 20:13:20 * Background append only file rewriting started by pid 7068

[7066] 09 Aug 20:13:21 * Background append only file rewriting terminated with success

[7066] 09 Aug 20:13:21 * Parent diff flushed into the new append log file with success (0 bytes)

[7066] 09 Aug 20:13:21 * Append only file successfully rewritten.

[7066] 09 Aug 20:13:21 * The new append only file was selected for future appends.

[7066] 09 Aug 20:13:25 - 1 clients connected (0 slaves), 547396 bytes in use

我们在主库上设置一对键值对

redis 127.0.0.1:6379> set name HongWan

OK

redis 127.0.0.1:6379>

在从库上取一下这个键

redis 127.0.0.1:6378> get name

"HongWan"

redis 127.0.0.1:6378>

说明主从是同步正常的.

那么我们如何判断哪个是主哪个是从呢?我们只需调用info这个命令就可以得到主从的信息了,我们在从库上执行info命令

redis 127.0.0.1:6378> info

.

.

.

role:slave

master_host:localhost

master_port:6379

master_link_status:up

master_last_io_seconds_ago:10

master_sync_in_progress:0

db0:keys=1,expires=0

redis 127.0.0.1:6378>

里面有一个角色标识,来判断是主库还是从库,对于本例是一个从库，同时还有一个master_link_status用于标明主从是否异步，如果此值=up，说明同步正常;如果此值=down，说明同步异步;

db0:keys=1,expires=0， 用于说明数据库有几个key,以及过期key的数量。